Stack-based and heap-based buffer overflow attacks, based on Counter Hack Reloaded (by Skoudis & Liston), & other sources.

1. Network Security:Buffer Overflow Attacks Joe McCarthy

2. Today’s Agenda What is Network Security? Why should you care? What is a network security attack? What is a buffer overflow attack? Where can you learn more? All in 30 minutes …

3. What is Network Security? Computer Security The protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability and confidentiality of information system resources (includes hardware, software, firmware, information/data, and telecommunications) February 2004 http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf Network Security Essentials, 4/E William Stallings Prentice Hall, 2011

4. Why study Network Security? Multi-disciplinary Computer science, mathematics, psychology, sociology, politics, ethics, economics, forensics, … New way of thinking: security mind set Preventing undesirable behavior vs. enabling desirable behavior Personal relevance Keeping your personal data & devices safe Professional relevance

5. TCSS 431: Network Security Counter Hack Reloaded: A Step-by-Step Guide to Computer Attacks and Effective Defenses, 2/E Ed Skoudis Tom Liston Prentice Hall, 2006 Network Security:Private Communication in a Public World, 2/E Charlie Kaufman Radia Perlman Mike Speciner Prentice Hall, 2002

6. Today’s Agenda 1. Introduction 2. Networking Overview 3. Linux and UNIX Overview 4. Windows NT/000/XP/00 Overview 5. Phase 1: Reconnaissance 6. Phase 2: Scanning 7. Phase 3: Gaining Access Using Application & OS Attacks Script Kiddie Exploit Trolling Pragmatism for More Sophisticated Attackers Buffer Overflow Exploits Password Attacks Web Application Attacks Exploiting Browser Flaws 8. Phase 4: Gaining Access Using Network Attacks 9. Phase 4: Denial-of-Service Attacks 10. Phase 4: Maintaining Access: Trojans, Backdoors& Rootkits 11. Phase 5: Covering Tracks & Hiding 12. Putting It All Together: Anatomy of an Attack 13. The Future, References & Conclusions Counter Hack Reloaded: A Step-by-Step Guide to Computer Attacks and Effective Defenses, 2/E Skoudis & Liston Prentice Hall, 2006

7. Anatomy of an Attack Reconnaissance “casing the joint” Discovery of physical & online sensitive information Names, contact info (phone, email), IP addresses Social engineering, dumpster diving, Google Scanning “trying doorknobs & windows” Search for openings, network topology, OS type(s) Wireless access points, TCP ports, routers, gateways Inventory of target system & possible vulnerabilities Gaining access “breaking in” Application & OS attacks (Chapter 7) Stack-based & Heap-based Buffer Overflow Attacks

10. A program is a collection of segments such as:

11. main program,

12. procedure,

13. function,

14. global variables,

15. common block,

16. stack,

17. symbol tablehttp://courses.washington.edu/css430/ppt/Memory.ppt

18. Stack-based Buffer Overflow Attacks

19. Stack-based Buffer Overflow Attacks

20. Stack-based Buffer Overflow Attacks

21. Stack-based Buffer Overflow Attacks

22. Stack-based Buffer Overflow Attacks

23. C library functions considered harmful

24. C library functions considered harmful Frank Rubin. (March 1987) Communications of the ACM 30 (3): 195–196. Donald Moore, Chuck Musciano, Michael J. Liebhaber, Steven F. Lott and Lee Starr. (May 1987) Communications of the ACM 30 (5): 351–355. http://en.wikipedia.org/wiki/Considered_harmful

25. Finding stack-based buffer overflow vulnerabilities Examine source code (if available) Use debugger on executableto find exploitable library Apply brute force Inundate application with input data Examine stack traces after crashes But what would you input … & what would you look for?

26. Sample program #include <stdio.h> void f() { char s[9]; printf( "_________12345678901234567890" ); printf( "Enter s: " ); gets( s ); printf( "You entered: %s", s ); return; } main() { f(); }

27. Running the program

28. Running the program

29. Running the program

30. Running the program

31. Running the program 0x49 = “I”, 0x48 = “H”, 0x47 = “G”, 0x46 = “F”

32. Running the program 0x49 = “I”, 0x48 = “H”, 0x47 = “G”, 0x46 = “F”

33. Strategy & Structure of a “Sploit” “Fuzzing” Repeated input patterns AAAA… (“A” = 0x41) ABCDEFG… DEF1, DEF2, DEF3, … NOP (No Operation) 0x90 on x86 Also: Add 0 Multiply by 1 Jump to next instruction … NOP sled

34. Heap-based Buffer Overflow Attacks

35. Heap-based Buffer Overflow Attacks

36. Script Kiddies & Exploit Collections Attacks (exploits) are widely available French Security Response Team (FrSIRT) http://www.vupen.com/english/ “Only available to trusted organizations” Packet Storm Security http://packetstormsecurity.org/ Security Focus Bugtraq Archives http://www.securityfocus.com/bid Metasploit Project http://www.metasploit.com Little or no knowledge required

37. Exploitation Engines

38. Sample Payloads Bind shell to current port Bind shell to arbitrary port Reverse shell Windows VNC Server DLL Reverse VNC DLL Inject Inject DLL into running application Create local admin user The Meterpreter (Metasploit Interpreter)

39. Metasploit - GUI

40. Metasploit – command line

41. Pros & Cons of Exploit Frameworks

42. Pros & Cons of Exploit Frameworks Advantages for Attackers Reduced time Increased quality Advantages for Defenders Increased accuracy of security assessments Vulnerability scans yield many false positives (30-50%) Scan, then sploit to find “real” problems Verify IDS / IPS functionality Malfunctions, misconfiguration, pre-emptive attacks Improving management awareness “Please don’t steal this file!”

43. Defenses against Buffer Overflow Attacks Safer programming StackGuard, Stack Shield Security reviews ITS4 (“It’s the Software, Stupid - Security Scanner”) RATS (Rough Auditing Tool for Security) Flawfinder

44. For more information “Smashing the Stack for Fun and Profit” Aleph One, aleph1@underground.org http://www.phrack.org/issues.html?id=14&issue=49 Common Vulnerabilities & Exposures http://cve.mitre.org/cve/ Total CVEs: 45,149 Stack-based overflow vulnerabilities 1200+: IE, Safari, Firefox, Opera, RealPlayer, QuickTime, WMP, WinAmp, DB2, Excel, Access, Word, PowerPoint, OpenOffice, Eudora, Acrobat, Reader, JDK, JRE, Norton, McAfee, eTrust, RAZR Heap-based overflow vulnerabilities 900+: IE, Opera, Firefox, Thunderbird, Apache, VB, ColdFusion, Skype, PHP, Oracle, PostgreSQL, AIM, Windows Live Messenger, WordPerfect, Outlook Express, PageMaker, PowerPoint, Excel, Netscape, McAfee, DirectX, Shockwave, Subversion, QuickTime, Norton, Sophos, Kaspersky, RSA SecurID, PuTTY, iTunes, RealPlayer, WinAmp, OpenOffice, JRE, Facebook Photo Uploader ActiveX, Blackberry